Privacy policy

Unibox is a private email and calendar desktop application operated by Jackson Merkl. Questions about data or deletion can be sent to admin@jamcodes.ai.

Data the application accesses

When you authorize a Google account, Unibox uses Google OAuth through Nylas to access your account identity, email address, profile information, Gmail messages and threads, participants, labels, and calendar and event information. Message content, drafts, and attachments may be processed when the corresponding feature is used.

The requested Gmail permission allows reading, composing, sending, and organizing email. The requested Calendar permission allows reading and managing calendars and events, including changes and deletion. These permissions support the inbox and calendar features; granting permission does not itself send a message or change an event.

How data is used

Account data is used to synchronize and display your inbox and calendars, search and organize messages, prepare drafts, perform actions you authorize, and evaluate availability. Unibox does not sell Google user data, use it for advertising, or use it to train generalized AI or machine-learning models.

Processing and optional integrations

Nylas processes connected email and calendar data to provide synchronization and API access. Google and Nylas also process information under their own applicable policies. Authorized AI clients can access data through Unibox’s service interfaces when the operator configures and grants that access. Information supplied to an AI client may be processed by that client’s provider under its own terms; connecting Gmail alone does not automatically send your mailbox to an AI provider.

Optional Jam CRM integration can look up participants by email address when enabled for an account. CRM sharing is off by default. Optional booking providers are configured separately. The public information site does not receive or display mailbox contents.

Storage and protection

The current installation stores synchronized content in a local SQLite database on the operator’s computer. Mail and calendar content is not application-encrypted in that database; device encryption and protected backups are important. Provider credentials are stored separately with restricted access. The local service requires authentication for account data. No storage or transmission method can guarantee absolute security.

Retention and deletion

Synchronized content is retained locally while the account is connected. Removing an account clears its cached account entities, but operation, approval, and audit history may remain. Existing backups may retain older data until the operator removes them. Revoking Google access prevents future authorized access but does not automatically erase existing local copies or backups. Contact the operator to request deletion of retained data.

Control and revocation

You choose which accounts to authorize. You can review and revoke access in Google Account third-party connections. You can also ask the operator to disconnect an account, disable optional integrations, or delete retained copies.

Google API Limited Use

Unibox’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Website and policy updates

This information site has no mailbox login, advertising, or application analytics scripts. Its hosting provider may process routine network and security information, such as IP addresses and request logs, to deliver and protect the site. Material changes to these practices will be reflected here with an updated date.